Configuring the authorization interceptor for z/OS Connect EE servers

Use the following procedure to configure the authorization interceptor for z/OS Connect EE servers.

Before you begin

Verify that the following items are set up:

• SAF authorization for z/OS Connect EE servers
• z/OS Connect EE keyring

To configure the authorization interceptor

1. Specify the following string in the ssl id tag:

   clientAuthenticationSupported="true"

   Information

   Example

   <ssl id="DefaultSSLSettings" keyStoreRef="defaultKeyStore" clientAuthenticationSupported="true" sslProtocol="TLSv1.2"      

      trustStoreRef="defaultTrustStore" />

2. Define the authorization interceptor in the interceptor list:

   Information

   Example

   <zosconnect_auditInterceptor id="auditInterceptor" sequence="1" apiProviderSmfVersion="2"/>
   <zosconnect_authorizationInterceptor id="authorizationInterceptor" sequence="2"/>
   <zosconnect_zosConnectInterceptors id="interceptorList" interceptorRef="authorizationInterceptor, auditInterceptor"/>

3. Define the zosconnect_zosConnectManager tag as follows:

   • Connect the MVJE PAS user ID to a group in globalAdminGroup,
   • Set requireAuth to true.
   • Set requireSecure to true.

   Information

   Example

   <zosconnect_zosConnectManager
    globalInterceptorsRef="interceptorList"
    globalAdminGroup="ZCONADM,MVJE"
    globalOperationsGroup="OPR"
    globalInvokeGroup="ALLZUID"
    globalreaderGroup="ALLZUID"
    setUTF8ResponseEncoding="true"
    requireAuth="true"
    requireSecure="true"
    />